CVE-2024-53582
HIGHOpenPanel 0.3.4 - Path Traversal via File Manager Copy and View Functions
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2024-53582. PoCs published by Korn Chaisuwan_ Charanin Thongudom_ Pongtorn Angsuchotmetee.
AI-analyzed exploit summary This exploit demonstrates a directory traversal vulnerability in OpenPanel's File Manager 0.3.4 via the `view_file` endpoint. By manipulating the `filename` and `path_param` parameters, an attacker can access arbitrary files outside the intended directory, such as `/etc/shadow`.
Description
An issue found in the Copy and View functions in the File Manager component of OpenPanel v0.3.4 allows attackers to execute a directory traversal via a crafted HTTP request.
Exploits (2)
This exploit demonstrates a directory traversal vulnerability in OpenPanel's File Manager 0.3.4 via the `view_file` endpoint. By manipulating the `filename` and `path_param` parameters, an attacker can access arbitrary files outside the intended directory, such as `/etc/shadow`.
This exploit demonstrates an incorrect access control vulnerability in OpenPanel 0.3.4, allowing unauthorized directory traversal via a crafted HTTP GET request. The request bypasses access controls to traverse directories using '../..' in the path.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N